EFS, XP, SP and badly decrypted files

[Robert Killin]

Hi,

I have a very strange problem on my XP. I have reinstalled my XP (I had XP
SP1 before, and I save all encryption keys - RA too), and becase my earlier
encrypted files became unaccessible, I have decrypted them with the
previously saved RA (setting encryption flag to none).
The result of decryption was that some of files became OK (readable
accessible etc), and some of them became accessible but the content became
bad (probably badly decrypted or still encrypted).
Please note that SP1 was not installed at that time.
I have found a Microsoft KB for that type of behaviour but It doesn't
specify any solution if files are already decrypted (if they are not than
suggest to decrypt files on the earlier system - something with encryption
method DESX ... ASE).

Did anybody know any solution to recover the mentioned badly decrypted
files?
Any help is more than welcome.

Thanks,
Robert

 

[jerry]

IF you encypted the Files with SP1 installed & are now
trying to recover them without SP1 installed the result
will be a decrypted file but you wont be able to read it,
this is because SP1 uses a different algo' by default AES-
25 as opposed to DES-128, this is what may cause the
gibberish--- try installing SP1 again & see how they look -
-

I hope im on the right track with you-- kindly let me know
if im not-- i experienced a similiar problem but fixed it
by installing SP1 & then the files became readeable.

best of luck - Jerry

 

[jerry]

Correction to my previous post -- SP1 uses AES-256 ( I
accidentally typed AES-25) '-)

 

[Robert Killin]

Hi Jerry,

The problem is that I have decrypted my files by setting encryption
checkbox to empty before applying SP1 to my system. I think that now it
won't help to make it back (mark as encrypted) - .
Now I have SP1 on my computer.
Did you know the rules for generating FEK for files? I think that now my
files cannot be recovered.

Thanks anyway.

Regards,
Robert

 

[Drew Cooper [MSFT]]

We don't have any way to recover your data when this happens. You might be
able to scavenge the encrypted file from the drive with file recovery tools,
but I really doubt it.

For anyone wondering what happened to Robert's data:
- It was encrypted on XP SP1 using AES.
- It was decrypted on XP (no service pack), which thought the data was
encrypted in 3DES.
- The newly-"decrypted" file is garbage data.
- The old symmetric key used to encrypt the data is gone. There is no way
to get the data back into its AES-encrypted format.